Ledger said all confirmed cases linked to last week’s suspected cryptocurrency wallet drain involved hardware wallets sold by Southeast Asian reseller CryptoBilis, while the manufacturer’s own systems and direct sales channels remained unaffected.
The Paris-based company said the number of impacted devices was limited and that it was working with authorities while contacting affected users. CryptoBilis has also confirmed that it stopped selling hardware wallets. The update followed reports from users in Southeast Asia who said they lost funds after buying Ledger devices through the reseller.
According to Decrypt, Ledger began investigating the incident on Friday and issued a 72-hour update on Sunday. The company has not confirmed the total amount allegedly stolen or explained what caused the losses.
Investigation points to suspected $87 million drain
Onchain investigator Specter traced more than $86 million in suspected thefts across the Ethereum, Tron and Bitcoin networks. The figure has not been confirmed by Ledger.
Another investigator, YFarmX, said it provided Ledger with a list of more than 450 wallets that had been drained. Its analysis described several movements involving the allegedly stolen assets:
- About 2,810 ETH was sent through the Tornado Cash coin mixer in three transactions before withdrawals moved through Zcash’s shielded pool.
- Roughly 3.28 million USDC was withdrawn into three newly created wallets. YFarmX said Circle, the issuer of USDC, could freeze those funds.
- The thief converted 15 million USDT into USDD, a stablecoin that Tether cannot freeze, then swapped 5.1 million USDD back into USDT.
- About 4.23 million USDT was sent to deposit addresses at Binance.
YFarmX said Tether froze 10 million USDT on the first day. It also said that 15,475 ETH, 203 BTC and 10 million USDD remained beyond reach. These findings have not been independently verified.
A hardware wallet is a physical device designed to store the credentials used to authorize cryptocurrency transactions. The incident has focused attention on the supply chain around such products: Ledger’s statements point to devices sold through CryptoBilis rather than a compromise of Ledger’s systems or official direct-sales operation.
Ledger tightens reseller guidance
Ledger said it was reminding authorized distributors and resellers to obtain products only through approved channels and never return products to inventory after they have been sent back by customers.
The company warned buyers against unauthorized sellers, saying such channels carry a significant risk of counterfeit, suspicious or modified devices. Ledger said it was reviewing its reseller controls and working on additional hardware protections, while urging other companies in the industry to cooperate on supply-chain and anti-tampering measures.
The company’s guidance is specifically aimed at people who bought devices from CryptoBilis. Ledger said buyers should not initialize unused devices. Customers who have already set one up were told to transfer their funds to a new seed phrase generated on a device purchased directly from Ledger.
A seed phrase is the sequence of words used to recover access to a cryptocurrency wallet. Ledger also cautioned users about follow-on scams, saying it would never call or send a direct message asking for a 24-word recovery phrase.
Reports of other devices remain unconfirmed
An X user identified as Johannes said he found what he described as tampered Ledger devices in Europe after purchasing two from retail stores. He claimed the devices contained identical changes, including additional cables and an LTE module, and called for a product recall.
Those claims have not been independently verified. Ledger’s latest update said every confirmed case so far involved devices sold by CryptoBilis. Johannes said he was sending the second device to Ledger for examination. Decrypt contacted Ledger about the European reports.
Market picture
Moneyiar market data at 09:59 on October 13, 2026, showed a broadly weaker picture among the listed assets. edgeX (EDGE) was trading at $0.3348013316, down 6.96% over 24 hours and 26.06% over seven days. Rain (RAIN) stood at $0.0100403954, down 3.3% in 24 hours and 12.21% over the week.
Ailey (ALE) was priced at $0.2678774672, with a 24-hour decline of 0.2% and a seven-day decline of 0.71%. Walrus (WAL) was at $0.0378799591, down 0.77% over 24 hours but up 3.6% over seven days. These market movements are presented as Moneyiar data and are not described as being caused by the Ledger incident.
